TLS and HTTP versions¶
How HTTPS is terminated for platform apps vs portfolio.
Platform apps (Traefik on VPS)¶
Hosts: git, ci, pm, status, security, docs (and other Traefik routers).
| Protocol | Status |
|---|---|
| TLS 1.2 | Enabled (Traefik default) |
| TLS 1.3 | Enabled (preferred) |
| HTTP/2 | Enabled |
| HTTP/3 | Enabled (QUIC on UDP 443) |
| TLS 1.0 / 1.1 | Rejected |
Config:
traefik/traefik.yml—entryPoints.websecure.http3docker-compose.yml— Traefik publishes443/tcpand443/udpscripts/setup-vps.sh— UFW allows443/udp
Verify after deploy¶
# Alt-Svc should advertise h3
curl -sSI https://git.rafaelgonzalezalbes.com/ | grep -i alt-svc
# TLS versions
echo | openssl s_client -connect git.rafaelgonzalezalbes.com:443 -servername git.rafaelgonzalezalbes.com 2>/dev/null | grep Protocol
Existing VPS (one-time)¶
If the box was set up before HTTP/3:
ufw allow 443/udp comment 'HTTPS HTTP/3 QUIC'
ufw status | grep 443
Then redeploy / recreate Traefik so UDP 443 is published.
Portfolio (IONOS + Cloudflare)¶
Apex rafaelgonzalezalbes.com is served from IONOS (SFTP), not Traefik. Shared Apache there typically offers TLS 1.2 only and no HTTP/3.
Recommended: terminate TLS at Cloudflare for both apex and www (orange-cloud proxy). Cloudflare provides TLS 1.3 + HTTP/3 to browsers; origin can stay IONOS.
Step-by-step: Portfolio → Cloudflare HTTPS.
Do not orange-cloud platform subdomains (git, ci, …) unless you intentionally change that architecture — they must resolve straight to the VPS for Let's Encrypt and Traefik.